UNC3944 | VMware - Suspicious Cross-VM Disk Attachment

R W@shiftyroot

•updated Jul 25, 2025•2•1•74

Detects when a virtual disk (.vmdk) from one virtual machine is attached to a different virtual machine. This is a key TTP used by threat groups like UNC3944 to perform offline credential theft (e.g., copying NTDS.dit from a domain controller) by mounting the disk to a separate, attacker-controlled staging VM.